Privacy Policy
This is the same policy shown inside the Vararuchi app (Settings → Privacy), published here for transparency. The in-app version is where you exercise data controls such as Export My Data and Delete My Account. See also the Terms of Service.
What changed in v1.7 (25 October 2026): nothing in this policy. Its version moves with the Terms, whose free welcome month changed.
What changed in v1.6 (21 October 2026): what we keep if you join Invite & Earn or were invited by a member; voice recordings for pronunciation scores; and four services added to the list in section 4 — Mistral AI, Cashfree Payments, Google Cloud Text-to-Speech and Microsoft Azure AI Speech. Mistral AI already read scanned documents before this update and should have been listed. For an existing account these changes apply 14 days after we tell you about them in the app, or when you accept them there, whichever is sooner.
1. What data we collect
We collect data only necessary to provide the service:
- Identity: Name and email from Google Sign-In (OAuth). We never store your Google password.
- Learning data: Topics studied, quiz scores, flashcard progress, knowledge mastery sessions, career roadmap, language learning history, and AI response style preferences (goal, pace, verbosity).
- Usage data: Spark (credit) usage, feature access timestamps, subscription tier.
- Uploaded content: Documents, audio files, and images you submit for AI analysis. Files are deleted from our servers after indexing. Text representations (embeddings) derived from your content are stored in our vector database (Pinecone) to power the Knowledge Mastery search feature; these are deleted when you delete the source or delete your account.
- Payment data: Order IDs and payment confirmation from Razorpay. We never receive or store card numbers. Payment records are retained for 6 years as required by the GST Act, 2017.
- Student verification data: For users applying for the Student discount plan — academic email address, institution name, enrollment dates, and a photo of your student ID card. Collected only with your explicit consent during the verification flow, used solely to verify student status, and retained for a maximum of 1 year. You may request deletion at any time. Governed by the Digital Personal Data Protection Act, 2023.
- Community data: Help Center posts, replies, bug reports, and feature requests that you create. Publicly visible to other users.
- Invite & Earn data: Only if you join the programme or sign up with a member’s invite link. For members: your invite code, which accounts joined with it, the reward each of their payments earned, your withdrawals, and — once you choose to withdraw — your UPI ID, the name on that bank account, and the name your bank holds for that UPI ID (checked through Cashfree Payments). For invited friends: the link to the member who invited you. A member sees only how many friends joined and paid and each reward’s amount, date and status — never who you are, what you bought or what you study.
- Voice recordings: Only when you ask for a pronunciation score. A recording of up to 15 seconds is sent to Microsoft Azure AI Speech to be scored, and is not stored by us.
- Consent records: Date and version of the Terms of Service and Privacy Policy you accepted, stored for audit purposes.
- Technical data: Browser type, device type, IP address (server logs retained 90 days), Firebase Analytics events (only if you accepted analytics cookies).
- App Check signals: reCAPTCHA v3 browser signals used by Firebase App Check to prevent automated abuse. Governed by Google's reCAPTCHA Privacy Policy.
2. Legal basis for processing (GDPR)
For users in the European Economic Area and UK, we process personal data under the following legal bases (GDPR Art. 6):
- Performance of contract (Art. 6(1)(b)): Processing necessary to provide the AI tutoring service, manage your subscription, and process payments — and, if you join Invite & Earn, to run the programme and pay your rewards.
- Consent (Art. 6(1)(a)): Analytics cookies and student verification data — you may withdraw consent at any time in Settings → Privacy.
- Legitimate interests (Art. 6(1)(f)): Security logging, abuse prevention, crash reporting, and service improvement through anonymised analytics.
- Legal obligation (Art. 6(1)(c)): Retaining payment records for 6 years under the GST Act, 2017, and Invite & Earn payout records for 8 years as tax records.
3. How we use your data
- To deliver personalised AI tutoring and track learning progress.
- To process payments and manage subscription tiers.
- To prevent abuse and enforce usage limits (Sparks system).
- To run Invite & Earn if you join it or were invited: to link friends to the member who invited them, calculate and pay rewards, and prevent fraud — for example, by checking that a payment was not made from the member’s own UPI ID.
- To improve the service through anonymised analytics (only with your consent).
- We do not sell, rent, or share your personal data with third parties for marketing.
- We do not use your learning data or uploaded content to train AI models.
4. Third-party services
We use the following sub-processors, each governed by their own privacy policies:
- Google Firebase — Authentication, Firestore database, file storage, hosting, and analytics
- Google Cloud Run — Serverless compute hosting for our backend API
- Vararuchi AI Engine — AI inference for all tutoring and learning responses (backed by third-party AI infrastructure providers under Data Processing Agreements)
- Pinecone — Vector database for Knowledge Mastery document search (RAG); hosted on AWS us-east-1
- Deepgram — Audio transcription for lecture and recording uploads
- Mistral AI — Text recognition (OCR) for scanned documents and photos uploaded to Knowledge Mastery; hosted in the EU
- Firecrawl — Web content extraction for URL-based knowledge ingestion
- Google Cloud Text-to-Speech — Spoken audio of course text, for languages your device has no voice for
- Microsoft Azure AI Speech — Pronunciation scores, from a recording of up to 15 seconds made only when you ask for a score; not stored by us
- Razorpay — Payment processing (PCI-DSS Level 1 compliant); we never receive card or bank details
- Cashfree Payments — Paying Invite & Earn rewards to members’ UPI IDs, and checking with the member’s bank that a UPI ID is in their name; India
- Upstash Redis — Rate-limiting cache; stores anonymised user ID and request count only
- Sentry — Crash reporting; error events are scrubbed of personally identifiable information before transmission. Sentry retains event data for 90 days.
All sub-processors are bound by Data Processing Agreements (DPAs) consistent with GDPR Art. 28 and DPDPA 2023 § 8. Cross-border transfers to processors outside India and the EU are governed by Standard Contractual Clauses (SCCs) or equivalent safeguards.
5. Data retention
- Your account data is retained until you delete your account.
- Uploaded files are deleted from our servers immediately after processing.
- Document embeddings (vectors) in Pinecone are deleted when you delete the source document or when you delete your account.
- Payment audit logs are retained for 6 years as required by the GST Act, 2017.
- Invite & Earn payout records (UPI ID, name on the account, amounts and dates) are retained for 8 years after the financial year of each payout, as tax records. A friend’s link to the member who invited them is deleted when either account is deleted.
- Server access logs are retained for 90 days.
- Student verification photos are retained for up to 1 year from verification and then deleted.
- Community posts remain unless you delete them. Deleted posts are permanently removed.
6. Your rights (GDPR / DPDPA / CCPA)
Under applicable law (GDPR, DPDPA 2023, and CCPA), you have the right to:
- Access your personal data — use "Export My Data" in Settings → Privacy (complete JSON download from our servers).
- Rectify inaccurate data — contact us at admin@vararuchi.com.
- Erase your data — use "Delete My Account" in Settings → Privacy. This permanently deletes all learning data, uploaded content, vectors, and community posts. Note: payment records are retained for 6 years per GST Act, 2017.
- Portability — "Export My Data" in Settings provides your full personal data across all features in machine-readable JSON format.
- Restrict processing or object — email us and we will suspend processing within 7 days.
- Withdraw consent — change analytics cookie preferences at any time in Settings → Privacy → Cookie Preferences.
- Lodge a complaint — you have the right to lodge a complaint with your local data protection authority. In the EU: your national DPA (see edpb.europa.eu). In India: the Data Protection Board of India (when operational). In the UK: the Information Commissioner's Office (ico.org.uk).
California residents (CCPA): You have the right to know what data we collect, the right to delete it, and the right to opt out of sale (we do not sell data). We do not discriminate against users who exercise CCPA rights. Requests: admin@vararuchi.com (response within 45 days).
To exercise any right, email admin@vararuchi.com. We respond within 30 days (45 days for CCPA requests).
6a. Deleting your account and data
You can delete your Vararuchi account and its data at any time. You do not need the app installed.
Delete it yourself, from the web
Go to the account deletion page. Sign in with your Google account and confirm — deletion starts immediately. This works in any browser, with or without the app.
In the app
Open Settings → Privacy → Delete My Account and confirm.
Or ask us
Email admin@vararuchi.com from the email address on the account. We verify ownership of the address and then delete the account. We respond within 30 days and normally complete deletion within 7.
Deleting only some of your data
You do not have to delete your whole account. You can delete individual Knowledge Mastery uploads (which also removes the AI embeddings made from them), your own community posts, and your learning history from Settings. See the deletion page for the full list.
What is deleted
- Your account and sign-in identity.
- All learning data — topics, sessions, progress, mastery, streaks, exam attempts and results.
- Everything you uploaded to Knowledge Mastery, including the file itself and its document embeddings (vectors) in Pinecone.
- Photo Solver images and their solutions.
- Your community posts and replies.
- Student verification documents and photos, where held.
What is retained, and why
- Payment records — 6 years. Required by the GST Act, 2017. These are financial records of a completed transaction; they are kept whether or not the account still exists, and are not used for any other purpose.
- Invite & Earn payout records — 8 years after the financial year of each payout, as tax records. If you are a member, anything still available is paid out to your UPI ID first, with no minimum.
- Server access logs — 90 days, then automatically discarded.
- Crash reports — 90 days in Sentry, already stripped of information identifying you.
If you bought a subscription through Google Play, deleting your Vararuchi account does not cancel it. Cancel it in Google Play → Subscriptions, or you will continue to be billed by Google.
7. Cookies & local storage
We use:
- localStorage / IndexedDB (essential): Storing your learning sessions and preferences locally for offline access. Always active as these are required for the app to function.
- Firebase session cookies (essential): Managed by Firebase Authentication for secure sign-in. Always active.
- Analytics cookies (optional): Firebase Analytics usage events. Only activated if you click "Accept all cookies." You can change this preference any time in Settings → Privacy → Cookie Preferences.
- reCAPTCHA v3 (essential): Browser signals collected by Firebase App Check to prevent automated abuse of the service.
8. Security
All data is transmitted over HTTPS. Firestore and Firebase Storage are protected by server-enforced security rules (owner-only access). Sensitive operations (subscription upgrades, payment processing, account deletion) are performed exclusively server-side using Firebase Admin SDK. Rate limiting and MIME type validation protect upload endpoints.
In the event of a personal data breach, we will notify the relevant supervisory authority within 72 hours of becoming aware (GDPR Art. 33) and affected users without undue delay where the breach is likely to result in high risk (GDPR Art. 34). Under DPDPA 2023, we will notify the Data Protection Board as required by applicable rules.
9. Children and young people
You must be at least 13 to hold a Vararuchi account, in every country. The age at which you may agree to our use of your data on your own behalf depends on where you live — 18 in India (Digital Personal Data Protection Act 2023, § 9), between 13 and 16 across the EU/EEA (GDPR Art. 8), and 13 in the United Kingdom, United States and most other countries. We ask for your year of birth and your country once, at sign-up.
Everyone under 18 is treated as a child, whatever their country. For those accounts we do not carry out behavioural tracking, profiling or targeted advertising, we do not enable analytics, and we do not use location to vary prices. Subscriptions cannot be purchased by an under-18 — a parent or guardian must buy on their behalf. Under-18s cannot join Invite & Earn and are never linked to the member who invited them. Free daily Sparks are unaffected.
Where a learner is below the age of consent for their country, a parent or guardian must give consent for us to process their data. We are building a verified guardian-consent flow and will require it before 13 May 2027, the date this obligation takes effect in India. Until then, if you are a parent or guardian and want to review, withdraw consent for, or delete your child's account, email us and we will act on it.
If you believe a child's data has been collected without proper consent, contact us at admin@vararuchi.com and we will delete the data within 72 hours.
10. Changes to this policy
We will notify users of material changes via in-app notification at least 14 days before the change takes effect. Continued use after the effective date constitutes acceptance.
Regional privacy addendums
California (CCPA / CPRA)
In addition to the rights above, California residents have the following additional rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):
- Right to Know: Request disclosure of the categories and specific pieces of personal information collected about you, the categories of sources, and the business purposes for collection.
- Right to Delete: Request deletion of personal information we hold about you, subject to certain exceptions (e.g., payment records kept for legal compliance).
- Right to Correct: Request correction of inaccurate personal information. Contact admin@vararuchi.com with the correction requested.
- Right to Opt Out of Sale or Sharing: We do not sell or share your personal information for cross-context behavioral advertising. No action is required.
- Right to Limit Use of Sensitive Information: We only use sensitive personal information (student ID, academic email) for the purpose of verifying your student status. We do not use it to infer characteristics about you.
- Right to Non-Discrimination: We do not discriminate against you for exercising your CCPA/CPRA rights.
- Verified requests will be responded to within 45 days. To submit a request, email admin@vararuchi.com.
Canada (PIPEDA / Law 25 Quebec)
- Personal information is collected with your knowledge and consent, and only for the purposes described in this Privacy Policy.
- You may access or correct your personal information by contacting admin@vararuchi.com. We will respond within 30 days.
- Commercial electronic messages (if sent) comply with Canada's Anti-Spam Legislation (CASL). You may unsubscribe at any time via the link in any email we send.
- Privacy complaints may be directed to the Office of the Privacy Commissioner of Canada at priv.gc.ca.
Australia (Australian Privacy Act 1988)
- We comply with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth).
- You may request access to or correction of personal information held about you. Contact admin@vararuchi.com. We will respond within 30 days.
- If you are unsatisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner at oaic.gov.au.
- We do not transfer personal information outside Australia except to providers listed in our Privacy Policy, each of which provides equivalent data protection obligations.
Singapore (Personal Data Protection Act 2012)
- We comply with Singapore's Personal Data Protection Act 2012 (PDPA).
- You have the right to access and correct your personal data. Contact admin@vararuchi.com. We will respond within 30 days.
- Complaints may be directed to the Personal Data Protection Commission (PDPC) at pdpc.gov.sg.
Brazil (Lei Geral de Proteção de Dados — LGPD)
- We comply with Brazil's Lei Geral de Proteção de Dados Pessoais (LGPD), Law No. 13,709/2018.
- You have the right to confirm the existence of, access, correct, anonymize, block, delete, and port your personal data.
- The legal bases for processing your data are performance of contract (service delivery), consent (analytics cookies, student verification), and legal obligation (payment record retention).
- To exercise your rights or lodge a complaint, contact admin@vararuchi.com. Complaints may also be directed to the Brazilian National Data Protection Authority (ANPD) at gov.br/anpd.